Autotask Mcp
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's files and instructions are coherent with its stated purpose (running a local Autotask MCP Docker service) and the requested secrets are appropriate; the bundle installs no surprising third‑party code beyond pulling the upstream container image, but it does create user-level scheduled tasks if you enable auto-updates and there is a small metadata mismatch to note.
This skill appears to do what it says: run the Autotask MCP server locally in Docker and requires only your Autotask API credentials. Before installing or running: 1) Verify you trust the upstream image author (ghcr.io/asachs01/autotask-mcp) and consider pinning a digest before enabling auto-updates. 2) Ensure Docker and docker compose are installed and that you understand the service will bind to localhost:8080 only. 3) Manually create and edit the .env file (the skill insists on this) and do not share its contents; the scripts are written to avoid logging secrets but you should keep the file permissions (chmod 600). 4) Be aware that enabling the provided auto-update installer will create a user LaunchAgent or a systemd user timer — review those units if you enable auto-updates. 5) Ask the publisher or platform to fix the registry metadata mismatch (registry-level required-env vs. files) so the platform can correctly enforce secret handling.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
65/65 vendors flagged this skill as clean.
Risk analysis
No visible risk-analysis findings were reported for this release.